IP addresses with NetScaler fingerprints exposed to the internet: 23,000+ (Source: Shadowserver, as reported by BleepingComputer (September 28, 2026))
Citrix has confirmed that attackers exploited two NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, as zero-days. CISA has told U.S. federal civilian agencies to secure affected appliances by September 30, BleepingComputer reported on September 28, 2026. Both flaws let an unauthenticated attacker run code remotely. For any organization that uses NetScaler ADC or Gateway as its remote-access entry point, the open question is whether the appliance was already compromised, in addition to whether it has been patched.
What the flaws allow, and who is exposed
BleepingComputer's account says CVE-2026-88771 needs no special feature to be switched on: a standard setup of either ADC or Gateway is in scope. CVE-2026-88772 applies only where DTLS is enabled, and Citrix says DTLS is on by default for VPN virtual servers. Citrix reports having observed exploitation on unmitigated deployments. The report also relays that NCSC-NL, the Dutch national cyber security center, is said to have alerted organizations in the Netherlands to two NetScaler flaws that were still unnumbered at the time and were being used to load malicious code straight into memory.
By product, Shadowserver's figures split into about 22,000 ADC and about 1,500 Gateway. The report notes there is no data on how many of these are honeypots, already patched, or running vulnerable configurations. The figure measures internet visibility, not confirmed vulnerability.
Patching and compromise assessment are separate tasks
Citrix has made what it calls "generic Indicators of Compromise" available through NetScaler Console. It cautions that they may have "limited forensic value" and can miss real intrusions, and it recommends hiring experienced forensic investigators. CISA's guidance adds a sequencing point: if compromise is suspected, preserve forensic evidence before applying updates, because updates may reduce forensic visibility.
For an executive, this changes what "done" means. A ticket closed on patch deployment does not answer whether an attacker already held access.
Advance warning came through private channels
Citrix's updates followed, by days, a round of private outreach from national cybersecurity agencies, IT suppliers and security teams, who were telling NetScaler customers to take appliances offline. Citrix's own Sunday advisory post carried a 'noindex' meta tag, which asks search engines not to index the page. That makes direct vendor and government contact channels a relevant intake route for this advisory.
Earlier 2026 NetScaler exploitation, per the same report
The report also lists two earlier NetScaler incidents this year. Citrix asked administrators in March to patch CVE-2026-3055 and CVE-2026-4368, and exploitation began several days afterward. In early September, attackers started using the authentication bypass CVE-2026-19490, which had been fixed in mid-August.
What the federal deadline does and does not mean
The deadline binds Federal Civilian Executive Branch agencies. It is not a service-level standard for private organizations. Its value elsewhere is as a data point: CISA's statement says attackers are exploiting at least some of these flaws, and both CVE IDs now sit in the KEV catalog.
Questions to put to your team
1. Do we run NetScaler ADC or Gateway? Which versions are internet-facing, and is DTLS enabled on our VPN virtual servers?
2. Before updates were applied, was forensic evidence preserved? Have we engaged outside investigators, given Citrix's own caveat about its indicators?
3. Who in the organization receives Citrix and national-agency notices directly, rather than relying on public search?
4. How many days passed between patch release and deployment on our appliances for the March and September 2026 flaws, and what does that tell us about this week?
5. If an appliance is found compromised, which credentials and sessions passing through it need review?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: BleepingComputer.
